CVE Vulnerability Catalog

An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_task:job:update permission to cause a Denial of Service (DoS) by manipulating the func field of scheduled tasks.

An authenticated arbitrary file upload vulnerability in the /api/create-car-image component of bookcars v8.3 allows attackers to execute arbitrary code via uploading a crafted file.

GPAC MP4Box v2.4 has a NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c). Attackers can cause a Denial of Service (DoS) by supplying a crafted MP4 file.

GPAC MP4Box version 2.4 contains a floating point exception in the gf_opus_parse_packet_header function. Attackers can exploit this to cause a Denial of Service (DoS) via a crafted MP4 file.

GPAC MP4Box version 2.4 has a null pointer dereference in gf_isom_get_user_data_count (isomedia/isom_read.c). An attacker can supply a crafted MP4 file causing a crash (DoS).

In Malwarebytes 4.x and 5.x (and Nebula from 2020-10-21), a large number of Firefox preference files can cause the parser to ignore other browser configuration files, leading to denial of service.

An Improper Link Resolution Before File Access ('Link Following') vulnerability in Dell/Alienware Purchased Apps versions prior to 1.1.32.0 allows a low privileged attacker with local access to potentially exploit it, leading to Arbitrary File Write.

Dell Inventory Collector Client before version 13.8.0 contains an improper link resolution before file access ('Link Following') vulnerability. A low privileged attacker with local access can exploit this to achieve arbitrary file write.

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation requires user interaction to open a malicious file.

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application, requiring user interaction (opening a malicious file).

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application, requiring user interaction (opening a malicious file).

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Unrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of availability.

Improper access control in AMD uProf may allow a local attacker with user privileges to write to the kernel-shared memory section, potentially resulting in crash or denial of service.

Improper access control for register interface in the Input-Output Memory Management Unit (IOMMU) could allow a privileged attacker to cause non-coherent accesses by the AMD Secure Processor (ASP), potentially resulting in loss of integrity.

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification of router software and functionality.

A vulnerability in Windows NTLM exposes sensitive information to an unauthorized actor, allowing spoofing over a network.

Missing authentication for a critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Hermes WebUI before version 0.51.303 contains a TOCTOU race condition vulnerability in the git_discard function within api/workspace_git.py, allowing attackers to delete files outside the configured workspace boundary by replacing a validated path component with a symlink.

Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to retrieve session titles and transcript message content from profiles other than their own active profile.